CVE-2026-8401

The error classified as CWE-693 (Protection Mechanism Failure) indicates the ineffectiveness of the protection mechanism — in this case the sandbox. An attacker can exploit the vulnerability in the Profile Backup component to escape from the restricted browser execution environment. The attack can be conducted remotely, without authentication and without any user interaction, which makes it particularly dangerous.

Successful exploitation of the vulnerability allows an attacker to escape from the browser sandbox, which may lead to obtaining unauthorized access to the operating system, violating data confidentiality and integrity, and destabilizing system operation.

The software must be immediately updated to Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11 or Thunderbird 140.11, in which the vulnerability has been patched by the vendor.

Mozilla Firefox in versions before 150.0.3, Mozilla Firefox ESR in versions before 115.36 and before 140.11, Mozilla Thunderbird in versions before 140.11.